[accessors] handle `writable` changing during ArrayLengthSetter

test/mjsunit/array-length.js

Index: test/mjsunit/array-length.js
diff --git a/test/mjsunit/array-length.js b/test/mjsunit/array-length.js
index 02103fa3713e22ee6256068f490292019036f1eb..ea2a6725b7c8b2506b47bbdf02988f1feab10f15 100644
--- a/test/mjsunit/array-length.js
+++ b/test/mjsunit/array-length.js
@@ -132,3 +132,30 @@ for (var i = 0; i < 7; i++) {
   var frozen_object = Object.freeze({__proto__:[]});
   assertThrows(function () { frozen_object.length = 10 });
 })();
+
+(function sloppyReentrantDescriptorChange() {
+  var b = [];
+  b.length = {
+    valueOf() {
+      Object.defineProperty(b, "length", {writable: false});
+      return 1;
+    }
+  };
+  assertEquals(0, b.length);
+})();
+
+(function strictReentrantDescriptorChange() {
+  var b = [];
+  assertThrows(() => {
+    "use strict";
+    b.length = {
+      valueOf() {
+        Object.defineProperty(b, "length", {writable: false});
+        return 1;
+      }
+    };
+  }, TypeError);
+
+  b.length = { valueOf() { return 0; } };
+  assertEquals(0, b.length);
+})();